URL: https://github.com/freeipa/freeipa/pull/5327 Author: flo-renaud Title: #5327: [Backport][ipa-4-9] Improve PKI subsystem detection Action: opened
PR body: """ This PR was opened automatically because PR #5290 was pushed to master and backport to ipa-4-9 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5327/head:pr5327 git checkout pr5327
From 4aef8c598288b60b5e7adbbff1dced7b3d27b243 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <f...@redhat.com> Date: Wed, 25 Nov 2020 09:53:54 +0100 Subject: [PATCH 1/2] Improve PKI subsystem detection The dogtaginstance.is_installed() method currently relies on the presence of the directory /var/lib/pki/pki-tomcat/{ca|kra}, even if it is empty. An unwanted consequence is ipa-server-upgrade wrongly assuming the KRA is installed and crashing when trying to upgrade a not-installed component. The fix relies on the command "pki-server subsystem-show {ca|kra}" to detect if a subsystem is installed. The command does not require PKI to be running (hence can be called anytime) and is delivered by the pki-server package which is already required by ipa server pkg. Fixes: https://pagure.io/freeipa/issue/8596 --- ipaserver/install/dogtaginstance.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py index da0fee2c30c..52dfc016a1e 100644 --- a/ipaserver/install/dogtaginstance.py +++ b/ipaserver/install/dogtaginstance.py @@ -177,8 +177,14 @@ def is_installed(self): Returns True/False """ - return os.path.exists(os.path.join( - paths.VAR_LIB_PKI_TOMCAT_DIR, self.subsystem.lower())) + try: + result = ipautil.run( + ['pki-server', 'subsystem-show', self.subsystem.lower()], + capture_output=True) + # parse the command output + return 'Enabled: True' in result.output + except ipautil.CalledProcessError: + return False def spawn_instance(self, cfg_file, nolog_list=()): """ From 16ad450bf68671192fba87ab2823c57c72b79932 Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud <f...@redhat.com> Date: Wed, 25 Nov 2020 10:00:39 +0100 Subject: [PATCH 2/2] ipatests: add test for PKI subsystem detection Add a new upgrade test. Scenario: - create an empty /var/lib/pki/pki-tomcat/kra directory - call ipa-server-upgrade With issue 8596, the upgrade fails because it assumes KRA is installed. With the fix, ipa-server-upgrade completes successfully. Related: https://pagure.io/freeipa/issue/8596 --- ipatests/pytest_ipa/integration/tasks.py | 12 +++++++++++ ipatests/test_integration/test_upgrade.py | 25 +++++++++++++++++++++++ 2 files changed, 37 insertions(+) diff --git a/ipatests/pytest_ipa/integration/tasks.py b/ipatests/pytest_ipa/integration/tasks.py index cfd8b1512c1..de8c70c48a5 100755 --- a/ipatests/pytest_ipa/integration/tasks.py +++ b/ipatests/pytest_ipa/integration/tasks.py @@ -2439,6 +2439,18 @@ def get_sssd_version(host): return parse_version(version) +def get_pki_version(host): + """Get pki version on remote host.""" + data = host.get_file_contents("/usr/share/pki/VERSION", encoding="utf-8") + + groups = re.match(r'.*\nSpecification-Version: ([\d+\.]*)\n.*', data) + if groups: + version_string = groups.groups(0)[0] + return parse_version(version_string) + else: + raise ValueError("get_pki_version: pki is not installed") + + def get_healthcheck_version(host): """ Function to get healthcheck version on fedora and rhel diff --git a/ipatests/test_integration/test_upgrade.py b/ipatests/test_integration/test_upgrade.py index e66e849a4f3..03361dc8e20 100644 --- a/ipatests/test_integration/test_upgrade.py +++ b/ipatests/test_integration/test_upgrade.py @@ -278,3 +278,28 @@ def test_pwpolicy_upgrade(self): result = self.master.run_command(["ipa", "pwpolicy-find"]) # if it is still missing the oc it won't be displayed assert 'global_policy' in result.stdout_text + + def test_kra_detection(self): + """Test that ipa-server-upgrade correctly detects KRA presence + + Test for https://pagure.io/freeipa/issue/8596 + When the directory /var/lib/pki/pki-tomcat/kra/ exists, the upgrade + wrongly assumes that KRA component is installed and crashes. + The test creates an empty dir and calls ipa-server-upgrade + to make sure that KRA detection is not based on the directory + presence. + """ + # Skip test if pki 10.10.0 is installed + # because of https://github.com/dogtagpki/pki/issues/3397 + # pki fails to start if empty dir /var/lib/pki/pki-tomcat/kra exists + if tasks.get_pki_version(self.master) == tasks.parse_version('10.10.0'): + pytest.skip("Skip test with pki 10.10.0") + + kra_path = os.path.join(paths.VAR_LIB_PKI_TOMCAT_DIR, "kra") + try: + self.master.run_command(["mkdir", "-p", kra_path]) + result = self.master.run_command(['ipa-server-upgrade']) + err_msg = 'Upgrade failed with no such entry' + assert err_msg not in result.stderr_text + finally: + self.master.run_command(["rmdir", kra_path])
_______________________________________________ FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahosted.org